7/3/24, 23:17 How I unbricked CMU in my Mazda: yms — LiveJournal

TOP

YMS SUBSCRIBE MÁS READABILITY

How I unbricked CMU in Michael Yutsis

yms
my Mazda https://yms.livejournal.com/
2017-08-05 15:54:00

(Note: the Russian version is here (https://yms.livejournal.com/3006373.html) .)

What happened
Several months ago, I decided to upgrade the firmware in the CMU (Connectivity Master Unit, the
infotainment computer) in my Mazda 3 (2014). I already did it at least two times before, quite
successfully. As you may know if you did it too, the firmware package consists of two files, names
ending with ..._failsafe.up and ..._reinstall.up, which are copied to a USB drive to start the upgrade
process. The main part of the firmware is in the 2Gb reinstall file, the smaller failsafe part contains
some code controlling the upgrade process including bootloader, progress indicator, etc. When I
upgrade, I usually launch both of these files, failsafe first. This time, I upgraded from EU 56.00.513B
to EU 59.00.443C version; I decided to launch only the reinstall part after having read somewhere
that it's not mandatory to upgrade failsafe each time. When I ran reinstall, after some time it said,
"Failed to validate package certificate". At this stage, I should have seen the "red flag" and realize
that something is unusually wrong here. But I decided that if I would install failsafe first (which is
supposed to contain some basic launching code), the main part has a chance to start.
I ran failsafe, it upgraded successfully. But when I ran reinstall again, I got the same error message.
I thought OK, I'll look at it later, but now I have to drive somewhere. I started the engine and set out.
Everything worked fine.
When I arrived to my destination, I left the car and came back in half an hour. When I started the
engine again, the screen was black. Nothing worked, except for the last radio channel that was
tuned in (luckily it was the classical music one), and the volume and mute controls. The unit
obviously didn't boot, it was bricked (there was no way to do anything with standard controls).

What was next

With some effort, I took the unit out (the CMU and the screen); there are videos and pictures in the
web how to do it (e.g. here (https://www.youtube.com/watch?v=f4Ima1yqAJU) ); the service manual
is helpful too. At first, I made an attempt, as it was written here
(http://www.2x4logic.com/cmuconnectors.html) , to connect to the TTL console via the known pins
of the connector; then I even opened the unit's case and soldered wires right to the PCB contacts.
There were no signs of life; now I understand there could not be any.
Only two ways were left: either buy a new CMU (I found some on eBay), or get the old firmware
back. From these (http://www.2x4logic.com/mazdaconnect.html) two (http://www.2x4logic.com/jci-
failsafe.html) pages, I realized that what is to be restored is the SPI NOR flash, a 8-megabyte chip.
When I opened the case, I looked at its type, it was Spansion S25FL064A. After some search in the
Web, I've found that it's quite possible to reflash it with minimal "investments". I started two things
in parallel: on eBay, I ordered a used CMU and a programmer device. The CMU arrived first, but it
was not working; I got a refund and sent it back.

What to do
Here is what you need to unbrick your CMU:
know that it's quite possible and not that hard;
at every stage, know exactly what you're doing and understand possible risks (if your unit is
bricked, you have probably nothing to lose except for the chance to repair it);

https://yms.livejournal.com/3007282.html 1/9
7/3/24, 23:17 How I unbricked CMU in my Mazda: yms — LiveJournal
buy a USB programmer based on the CH341A chip ($3.5 on eBay, $10 on Amazon);
find a way to unsolder a SOIC-16 (https://en.wikipedia.org/wiki/Small_Outline_Integrated_Circuit)
chip from the PCB and then solder it back. You may need a soldering iron with special soldering
tips; I was lucky to have a friend, an electronic engineer, with necessary equipment and skills. Be
careful with (un)soldering, PCB tracks may be damaged by overheating!);
be able to analyze the firmware structure, understand what was wrong and how to fix it at the
level of binary editing.
Note: you probably don't have to unsolder the chip. There exist programmer test clips for such
chip packages. I ordered one on eBay but it came too late, I managed without it. I don't know if
the programmer would work with the chip staying on the PCB. With this clip, you'll need some
soldering too (wires etc.), but without the risk to damage the chip or PCB tracks. The clip looks
like this:

If you succeeded to reflash the chip in place (without unsoldering) using the clips, please let me
know.

When I received the programmer, I installed the software which is easy to find in the web; there are
YouTube videos where people install it. The programmer is suitable for several kinds of chips; this
is how it looked when assembled with my chip, soldered on the special panel (which is enclosed
with the device):

(https://photos.app.goo.gl/po5YHpTulaIgTnqw2)

There is a jumper there, initially connecting pins 1 and 2; you don't need to change it, this position
fits the driver installed with the CH341PAR.EXE installer (there is another one, CH341SER, which you
won't need). Besides the chip, we soldered two rows ot contacts to the panel, they were also
included in the package. You can see how they should be soldered on the picture. In fact, this
panel is an adapter between the 16-pin chip and the 8-pin half of the socket. (The other half of the
socket is for other chip types, we're not interested in it.)

Healing the binary contents

I unzipped several failsafe.up packages from different firmware versions (the older one, the newer
one, and also several yet older and yet newer versions), they are zip files with the same known
password (you can find it in the web). Inside each one, besides root files, there are three
directories: bootstrap, fail-safe and ibc2. Each directory contains a number of .gz files, I unpacked
them too. They are regular gzip packages.

When the programmer (with my chip in it) was ready, the first thing I did was of course reading the
8-megabyte contents and saving it in a file. Thanks to this page (http://www.2x4logic.com/jci-
failsafe.html) (really thanks!!) I knew what I had to do with it.

In the bootstrap directory of each package, there are three files, e0000000001.dat,
e0000000002.dat and execute.ini. The contents of the .ini file implies that the actual name of
e0000000001.dat is update-bootstrap.sh (that is, a shell script starting the upgrade), and
e0000000002.dat is actually ibc-cmu-bootstrap.bin, which is the contents of the bootstrap partition
itself. The ibc2 directory contained the binary.ini file and two parts of the ibc2 partition. In the fail-
safe directory, I found another binary.ini and four parts of a bigger binary file sliced in 2M pieces.

I compared partitions of the chip with the files I unpacked. The contents of the bootstrap partition
was exactly equal to the file e0000000002.dat from the bootstrap directory of the new firmware.
Interestingly, up to the version 56.00.513B, the bootstrap code was the same in all versions; it
changed in 59.00.443C, and all subsequent packages have the same bootstrap code too. This
means, the trap was just in this upgrade. Further, the contents of the ibc1 partition on the chip was

https://yms.livejournal.com/3007282.html 2/9
7/3/24, 23:17 How I unbricked CMU in my Mazda: yms — LiveJournal
identical to the ibc2 file from the old firmware, and ibc2 partition was identical to the new ibc2 file.
That is quite logical: ibc1 loads the main system which was not upgraded, but ibc2 was upgraded
together with the failsafe code. And finally, the fail-safe partition was an exact copy of the sliced
binary file from the unpacked fail-safe directory, about 7.5M.

It was clear that all I have to do is replace all new parts of the firmware with the old ones, that is, the
bootloader, ibc2 and fail-safe. I didn't touch configuration sections; other partitions were either
absent or contained some data including version number in the text form, I changed the version to
the old one and dind't touch the rest.

There was some doubt whether I should change one byte at the address 0x10000 ("boot-select"),
from FF (boot the main system from ibc1) to 00 (boot failsafe from ibc2 to start upgrade from the
USB drive). I reasoned that all I needed for the system to work was restoring the old bootloader as
it was, and there was no reason to start the failsafe part at all. At the same time, I realized that my
case is virtually the same that was described on the same page (http://www.2x4logic.com/jci-
failsafe.html) : the new bootloader wouldn't load the old main part of the firmware. Only the
treatment was different.

I flashed the chip (it took two extra times to flash it before I figured out I have to erase it first,
otherwise nobody would turn zero bits into ones for me). My friend soldered the chip to its place on
PCB, I connected everything and the system booted as if nothing had happened.

Update Oct 2017: Now I successfully upgraded to EU 59.00.449A (first failsafe, then reinstall, no
reboot between them). I think my USB drive was defective when I made the previous attempt, but I
didn't try again with that unlucky 59.00.443C.

Tired of ads? Upgrade to account with Professional package of service and never see ads again!

Новости партнеров

"У меня осталось немного

Что купить вместо новой Как живет Гурцкая после времени": как живет Трагедия перечеркнула
«Нивы»: шесть надежных смерти мужа: тайны семьи актриса Светлана счастье в доме певицы
иномарок выдал отец Началовой Крючкова Подольской

https://yms.livejournal.com/3007282.html 3/9
7/3/24, 23:17 How I unbricked CMU in my Mazda: yms — LiveJournal

Мои твиты Мои твиты Мои твиты

Вт, 20:55: Нацгвирдия. Сб, 09:27: Девки спорили на даче, что такое Ср, 12:01: Песец велел передать, что он занят и
Фибоначчи. Оказалось, Фибоначчи - это кролики прислал вместо себя скунса.
на даче. Сб, 09:28: Кто умножает знанья сам,

81 comments

Anonymous
October 17 2017, 10:20:28 UTC COLLAPSE

U wrote "I didn't touch configuration sections; other partitions were either absent or contained some data including version number in the text form, I changed the
version to the old old one and dind't touch the rest."

Where did u excactly changed the version number? U talk about "some data" :D

Thank you very much!

yms
October 22 2017, 22:16:53 UTC COLLAPSE

Somewhere in the end of the config section, about offset 0x7E5C30 of the ROM, and probably in some other place wherever I found it (searchable in the editor).

Anonymous 6 years ago EXPAND

yms 6 years ago EXPAND

Anonymous 6 years ago EXPAND

yms 6 years ago EXPAND

Anonymous 6 years ago EXPAND

yms 6 years ago EXPAND

Anonymous 5 years ago EXPAND

Tutorial on how to reflash Maco Meza 4 years ago EXPAND

RE: Tutorial on how to reflash Anonymous 3 years ago EXPAND
Anonymous 3 years ago EXPAND

password Anonymous 6 years ago EXPAND

Re: password yms 6 years ago EXPAND
Re: password Anonymous 6 years ago EXPAND

Re: password Anonymous 5 years ago EXPAND

Re: password yms 5 years ago EXPAND
Re: password Anonymous 5 years ago EXPAND
Re: password yms 5 years ago EXPAND
Re: password Maco Meza 4 years ago EXPAND
Maco Meza 4 years ago EXPAND

Anonymous
October 20 2017, 08:08:32 UTC COLLAPSE

How were you able to change the Image of the Chip? Which program did u you use for changing the files?

yms
October 22 2017, 22:22:26 UTC COLLAPSE

I used my own simple command-line program which copies binary file fragments, but it's also possible to use any binary editor, e.g. the one built in the Visual
Studio.

Anonymous
November 4 2017, 09:10:49 UTC COLLAPSE

Hi, would you do this repairing bricked units as a side business? I have the exact same problem you had. Fail safe installed but the other one had failed validation.
Now black screen radio hiss only nothing else.

https://yms.livejournal.com/3007282.html 4/9
7/3/24, 23:17 How I unbricked CMU in my Mazda: yms — LiveJournal
yms
November 8 2017, 19:16:44 UTC COLLAPSE

No, no, I just can share my experience, don't want to convert it into business (and have no time), sorry.

Could you help me to recover my Mazda CMU! Anonymous 5 years ago EXPAND

password?
Anonymous
March 7 2018, 18:48:40 UTC COLLAPSE

you said "I unzipped several failsafe.up packages from different firmware versions (the older one, the newer one, and also several yet older and yet newer versions),
they are zip files with the same known password (you can find it in the web). "I couldnt find it. what is the password?

Re: password?
yms
December 5 2018, 20:33:33 UTC COLLAPSE

didn't see your comment in time, now changed the post settings. The answer is in another thread.

Can you help me to unbrick my car's CMU

Anonymous
August 28 2018, 14:02:51 UTC COLLAPSE

Hi yms !
My car verrsion 59.00.540ADR and it get stuck on boot logo when install USB Video Player 3.5, i tried to restore all file to original, but no luck!

I try this solution by reflash an image of SPI chip (version 56.00.513 ADR) and set the failsafe flag, it boot up to failsafe load, but when insert usb stick with 59.00.513
reinstall.up file to usb port, it show validating 56.00.513.... run about 20% (i looked up on serial console) and reboot to failsafe load again and again...
I don't know why it happend!

PS: i powered CMU up outside of the car!

Can you help me to recover My car's CMU...

Thank and best regards!

RE: Can you help me to unbrick my car's CMU

Anonymous
January 9 2020, 05:26:31 UTC COLLAPSE

I have the same problem as you, have you found a way to recover your CMU?

Anonymous
September 27 2018, 02:04:30 UTC COLLAPSE

Could you show me how to flash the chip, I load the e0000000002.dat to the IC but cannot boot up the cmu.I just hear the radio only.

yms
December 5 2018, 19:35:49 UTC COLLAPSE

didn't see this comment in time, the password is below in one of comments.

chip dump
Anonymous
October 18 2018, 20:59:27 UTC COLLAPSE

Thanks for sharing this information, this is great. Unfortunally I could not recover my unit until now. I have the problem that I had a software version from what I
cannot find the original files (V51) I tried to use the V56 files, but without succes. Can on you share your complete file with me? than I can write that onto the chip,
should work dont you think?

Re: chip dump

Anonymous
October 18 2018, 21:10:35 UTC COLLAPSE

after reading my own post I realized that this of cause is not the case. I will still have the wrong software in the system, so I need to find the files of the V51.
Anyone an idea where to get them?

Re: chip dump Anonymous 5 years ago EXPAND

Re: chip dump yms 5 years ago EXPAND
Re: chip dump Anonymous 5 years ago EXPAND

Re: chip dump yms 5 years ago EXPAND

3 more comments from Anonymous EXPAND

https://yms.livejournal.com/3007282.html 5/9
7/3/24, 23:17 How I unbricked CMU in my Mazda: yms — LiveJournal
Viên Tịnh
November 27 2018, 03:51:56 UTC Edited: November 27 2018, 04:05:59 UTC COLLAPSE

My cmu version was 51.00.351A and i tried to update to version 59.00.449A

after installed failsafe I accidently do reset via system configure and now my cmu totally bricked
(not really is my mistake but a tutorial told me to reset after every install file that is a huge mistake to trust that tutorial)
im tried to flash directly to the chip with some tool but can not found the original 51.00.351A fail safe file.
then i have to try the version 55 EU one in the fist try was none success but it was because of the cabble and the clip connected with the chip was fault.
I try again with version 31 and still failed did not know the problem was the cable conneting.
I did 3nd tries this morning and successed restored the healed binary to the chip.
Thank you so much for informations. thats every thing i need to unbrick my cmu.
really appreciate that.

soic16 clip:
https://i.imgur.com/n35Xyc6.jpg
spi NOR flash ic manufacture was Macronix Mx25L6445E
https://i.imgur.com/s7YHvQe.jpg
https://i.imgur.com/drxIQ3o.jpg
firmware before flashing
https://i.imgur.com/vCthGb6.jpg

yms
December 5 2018, 20:32:43 UTC COLLAPSE

Thank you for info!

need help saleh ahmed 5 years ago EXPAND

RE: need help Anonymous 5 years ago EXPAND

RE: need help Viên Tịnh 5 years ago EXPAND

Anonymous 4 years ago EXPAND

yms 4 years ago EXPAND

Anonymous 4 years ago EXPAND

how unzip and zip

Anonymous
December 10 2018, 17:47:49 UTC COLLAPSE

Hello,

how can i unzip and zip the firmware.

what program do u use?

thanks

Re: how unzip and zip

yms
December 11 2018, 14:06:19 UTC Edited: March 16 2019, 08:16:31 UTC COLLAPSE

To unpack ZIP archives with .up extension, you can use any program like WinZip or WinRAR.
To create the firmware image, you don't need to "zip" it, you need a binary editor and copy/paste chunks of bytes in it.

Re: how unzip and zip Anonymous 4 years ago EXPAND

need help in unbricking the CMU

saleh ahmed
December 31 2018, 22:41:23 UTC COLLAPSE

Hi,

I am trying to unbrick my CMU through your method as my system is exactly on the same situation as yours I got all the necessary components but when i am trying
to read the the SPI NOR flash its not giving me any result. all the fields are FF and "doted" as in this picture.
https://photos.app.goo.gl/snL1xBFjXwKEuRQ29

I really need your help. my SPI NOR flash is MXIC MX25L6445E, i tried couple of times to connect the cable through IC thinking that it is not connected correctly but
every time same result. My setup is this
https://photos.app.goo.gl/R3cLopRScRdC79Eo7

really appreciate your help

https://yms.livejournal.com/3007282.html 6/9
7/3/24, 23:17 How I unbricked CMU in my Mazda: yms — LiveJournal
Anonymous
January 18 2019, 14:50:24 UTC COLLAPSE

If you succeeded to reflash the chip in place (without unsoldering) using the clips, please let me know

I did it, works perfect

many thanks

In place reflash
Anonymous
January 20 2019, 19:19:28 UTC COLLAPSE

I've purchased a CH341A and a 16 pin clip. Anything special or different from this setup that needed to be done?

Re: In place reflash yms 5 years ago EXPAND

Re: In place reflash Stephen Kraushaar 5 years ago EXPAND
Re: In place reflash Anonymous 4 years ago EXPAND
Re: In place reflash rmgl 4 years ago EXPAND

What to write back on NAND Flash

Maco Meza
April 13 2019, 22:36:44 UTC Edited: April 13 2019, 22:37:52 UTC COLLAPSE

On the link named “this page”, on the last paragraph, author says the following “By deliberately corrupting the NAND-flash, I was able to force the "fail-safe" to start
from the very beginning (instead of the partial-resume feature it wants), and that allowed me to "unbrick" the unit. However, for a normal user or mechanic, this bad
behavior would require an expensive replacement of the unit.”

What exactly does it mean? We have to replace the first 4 sections with bootstrap info extracted from a fresh firmware gzip?
bootstrap 0x000000 0x000000
boot-select 0x010000 0x010000
ibc1 0x020000 0x020000
ibc2 0x040000 0x040000

Re: What to write back on NAND Flash

Anonymous
April 14 2019, 01:04:07 UTC COLLAPSE

It means that by changing the first byte of address 0x10000

from FF to 00 the guy was able to force a fail safe mode to reload the system from the .up files in the USB. This may or not work.

The author of this very page approach is different, he replaces the bad sectors of the loaded firmware in the flash chip with the same sectors from the .up failsafe
version and booting normal like nothing happens.

Maco Meza
April 15 2019, 21:04:18 UTC Edited: April 17 2019, 01:49:49 UTC COLLAPSE

I put my system on standby mode after upgrading v70 failsafe, now I have just a fm radio and volume.
I have tried to heal my bin, using a clip and ch341A, I have write FF to all chip, then write bootstrap from failsafe.up/bootstrap e0000000002.dat, then ibc2 from
failsafe.up/ibc2 00000000.dat and 00000001.dat, then failsafe partition from failsafe from failsafe.up/fail-safe 4 files.
I used first failsafe.up from v55, then from v70, I have tried set position 10000 a 00, and have tried with FF. With 00 my lcd is asking me to insert usb with update
files, but after some seconds it says "install not successful, system failure. Make sure that the USB with update package is inserted. The system will the automatically
retry the update" With FF, nothing happens.
What do you recommend?

Pass unzip failsafe.up

Anonymous
April 20 2019, 08:56:02 UTC COLLAPSE

Can you help me Pass to unzip ?

Re: Pass unzip failsafe.up

yms
April 21 2019, 08:00:11 UTC COLLAPSE

the answer is in one of the threads above:

5X/9vAVhovyU2ygK

CMU working again

Maco Meza
May 4 2019, 06:08:12 UTC COLLAPSE

https://yms.livejournal.com/3007282.html 7/9
7/3/24, 23:17 How I unbricked CMU in my Mazda: yms — LiveJournal
Hi guys,
I've finally restored my CMU, thank God!
I bought an used radio on ebay, a programmer CH341A and I am using CH341AFree.exe.
Then I read the bin from that NAND Flash chip, save it to my storage as rescue.bin.
Then I erased my damaged chip, then verified it was blank, then open rescue.bin from working CMU and write it to damaged CMU NAND Flash, and it is working
again. Then I updated firmware to latest. In a couple days, I will complete Carplay retrofit upgrade. If anybody wants my rescue.bin for North America, I will be glad
to help.

Re: CMU working again

Anonymous
May 8 2019, 18:25:46 UTC COLLAPSE

Hello, I would love to grab a copy of your rescue.bin much appreciated.

Also is it as simple as flashing the rescue.bin onto my bricked cmu to make it boot up again? Thanks!

Re: CMU working again Maco Meza 4 years ago EXPAND

Re: CMU working again Anonymous 4 years ago EXPAND
Re: CMU working again Maco Meza 4 years ago EXPAND
RE: Re: CMU working again gr3mmy 1 month ago EXPAND
APPLICATIONS
Re: CMU working again Anonymous 4 years ago EXPAND
Re: CMU working again Anonymous 4 years ago EXPAND

FOLLOW US:

Мои твиты Мои твиты Мои твиты

Вт, 20:55: Нацгвирдия. Сб, 09:27: Девки спорили на даче, что такое Ср, 12:01: Песец велел передать, что он занят и
Фибоначчи. Оказалось, Фибоначчи - это кролики прислал вместо себя скунса.
на даче. Сб, 09:28: Кто умножает знанья сам,

COMPANY

Sobre
News
Ayuda
Advertisers

PRODUCTS

Checklists
Livejournal Laboratory
"Share" button
Media program

COMMUNITY

Afisha LJ

Frank
Stylish merch

CHOOSE LANGUAGE

ESPAÑOL

Privacy Policy

Términos de servicio

Recommendation technologies

https://yms.livejournal.com/3007282.html 8/9
7/3/24, 23:17 How I unbricked CMU in my Mazda: yms — LiveJournal

Ayuda

v.737

https://yms.livejournal.com/3007282.html 9/9